openvpn: fix arguments passing to wrapped up and down scripts
With the introduction of the generic OpenVPN hotplug mechanism, wrapped
--up and --down scripts got the wrong amount and order of arguments passed,
breaking existing configurations and functionality.
Fix this issue by passing the same amount of arguments in the same expected
order as if the scripts were executed by the OpenVPN daemon directly.
Ref: https://github.com/openwrt/openwrt/pull/1596#issuecomment-668935156
Fixes: 8fe9940db6 ("openvpn: add generic hotplug mechanism")
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This commit is contained in:
Jo-Philipp Wich
CN_SZTL
parent
f37d0b447f
commit
0dc0b8e582
@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk
|
||||
PKG_NAME:=openvpn
|
||||
|
||||
PKG_VERSION:=2.4.9
|
||||
PKG_RELEASE:=2
|
||||
PKG_RELEASE:=4
|
||||
|
||||
PKG_SOURCE_URL:=\
|
||||
https://build.openvpn.net/downloads/releases/ \
|
||||
@ -112,6 +112,7 @@ define Package/openvpn-$(BUILD_VARIANT)/install
|
||||
$(1)/etc/init.d \
|
||||
$(1)/etc/config \
|
||||
$(1)/etc/openvpn \
|
||||
$(1)/lib/functions \
|
||||
$(1)/lib/upgrade/keep.d \
|
||||
$(1)/usr/libexec \
|
||||
$(1)/etc/hotplug.d/openvpn
|
||||
@ -128,6 +129,10 @@ define Package/openvpn-$(BUILD_VARIANT)/install
|
||||
files/usr/libexec/openvpn-hotplug \
|
||||
$(1)/usr/libexec/openvpn-hotplug
|
||||
|
||||
$(INSTALL_DATA) \
|
||||
files/lib/functions/openvpn.sh \
|
||||
$(1)/lib/functions/openvpn.sh
|
||||
|
||||
$(INSTALL_DATA) \
|
||||
files/etc/hotplug.d/openvpn/01-user \
|
||||
$(1)/etc/hotplug.d/openvpn/01-user
|
||||
|
||||
@ -1,17 +1,6 @@
|
||||
#!/bin/sh
|
||||
|
||||
get_option() {
|
||||
local variable="$1"
|
||||
local option="$2"
|
||||
|
||||
local value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+(([^ \t\\]|\\.)+)[ \t]*$/\1/p' "$config" | tail -n1 | sed -re 's/\\(.)/\1/g')"
|
||||
[ -n "$value" ] || value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+'"'([^']+)'"'[ \t]*$/\1/p' "$config" | tail -n1)"
|
||||
[ -n "$value" ] || value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+"(([^"\\]|\\.)+)"[ \t]*$/\1/p' "$config" | tail -n1 | sed -re 's/\\(.)/\1/g')"
|
||||
[ -n "$value" ] || return 1
|
||||
|
||||
export -n "$variable=$value"
|
||||
return 0
|
||||
}
|
||||
. /lib/functions/openvpn.sh
|
||||
|
||||
[ -e "/etc/openvpn.user" ] && {
|
||||
env -i ACTION="$ACTION" INSTANCE="$INSTANCE" \
|
||||
@ -23,8 +12,9 @@ get_option() {
|
||||
# Wrap user defined scripts on up/down events
|
||||
case "$ACTION" in
|
||||
up|down)
|
||||
if get_option command "$ACTION"; then
|
||||
exec /bin/sh -c "$command $ACTION $INSTANCE $*"
|
||||
if get_openvpn_option "$config" command "$ACTION"; then
|
||||
shift
|
||||
exec /bin/sh -c "$command $*"
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
|
||||
@ -0,0 +1,16 @@
|
||||
#!/bin/sh
|
||||
|
||||
get_openvpn_option() {
|
||||
local config="$1"
|
||||
local variable="$2"
|
||||
local option="$3"
|
||||
|
||||
local value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+(([^ \t\\]|\\.)+)[ \t]*$/\1/p' "$config" | tail -n1 | sed -re 's/\\(.)/\1/g')"
|
||||
[ -n "$value" ] || value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+'"'([^']+)'"'[ \t]*$/\1/p' "$config" | tail -n1)"
|
||||
[ -n "$value" ] || value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+"(([^"\\]|\\.)+)"[ \t]*$/\1/p' "$config" | tail -n1 | sed -re 's/\\(.)/\1/g')"
|
||||
[ -n "$value" ] || return 1
|
||||
|
||||
export -n "$variable=$value"
|
||||
return 0
|
||||
}
|
||||
|
||||
@ -77,10 +77,10 @@ config openvpn sample_server
|
||||
|
||||
# Diffie hellman parameters.
|
||||
# Generate your own with:
|
||||
# openssl dhparam -out dh1024.pem 1024
|
||||
# openssl dhparam -out dh2048.pem 2048
|
||||
# Substitute 2048 for 1024 if you are using
|
||||
# 2048 bit keys.
|
||||
option dh /etc/openvpn/dh1024.pem
|
||||
# 1024 bit keys.
|
||||
option dh /etc/openvpn/dh2048.pem
|
||||
|
||||
# Configure server mode and supply a VPN subnet
|
||||
# for OpenVPN to draw client addresses from.
|
||||
@ -228,10 +228,52 @@ config openvpn sample_server
|
||||
# This file is secret:
|
||||
# option tls_auth "/etc/openvpn/ta.key 0"
|
||||
|
||||
# For additional privacy, a shared secret key
|
||||
# can be used for both authentication (as in tls_auth)
|
||||
# and encryption of the TLS control channel.
|
||||
#
|
||||
# Generate a shared secret with:
|
||||
# openvpn --genkey --secret ta.key
|
||||
#
|
||||
# The server and each client must have
|
||||
# a copy of this key.
|
||||
#
|
||||
# tls_auth and tls_crypt should NOT
|
||||
# be combined, as tls_crypt implies tls_auth.
|
||||
# Use EITHER tls_crypt, tls_auth, or neither option.
|
||||
# option tls_crypt "/etc/openvpn/ta.key"
|
||||
|
||||
# Set the minimum required TLS protocol version
|
||||
# for all connections.
|
||||
#
|
||||
# Require at least TLS 1.1
|
||||
# option tls_version_min "1.1"
|
||||
# Require at least TLS 1.2
|
||||
# option tls_version_min "1.2"
|
||||
# Require TLS 1.2, or the highest version supported
|
||||
# on the system
|
||||
# option tls_version_min "1.2 'or-highest'"
|
||||
|
||||
# OpenVPN versions 2.4 and later will attempt to
|
||||
# automatically negotiate the most secure cipher
|
||||
# between the client and server, regardless of a
|
||||
# configured "option cipher" (see below).
|
||||
# Automatic negotiation is recommended.
|
||||
#
|
||||
# Uncomment this option to disable this behavior,
|
||||
# and force all OpenVPN peers to use the configured
|
||||
# cipher option instead (not recommended).
|
||||
# option ncp_disable
|
||||
|
||||
# Select a cryptographic cipher.
|
||||
# This config item must be copied to
|
||||
# the client config file as well.
|
||||
# Blowfish (default):
|
||||
#
|
||||
# To see all supported ciphers, run:
|
||||
# openvpn --show-ciphers
|
||||
#
|
||||
# Blowfish (default for backwards compatibility,
|
||||
# but not recommended due to weaknesses):
|
||||
# option cipher BF-CBC
|
||||
# AES:
|
||||
# option cipher AES-128-CBC
|
||||
@ -241,11 +283,16 @@ config openvpn sample_server
|
||||
# Enable compression on the VPN link.
|
||||
# If you enable it here, you must also
|
||||
# enable it in the client config file.
|
||||
#
|
||||
# Compression is not recommended, as compression and
|
||||
# encryption in combination can weaken the security
|
||||
# of the connection.
|
||||
#
|
||||
# LZ4 requires OpenVPN 2.4+ client and server
|
||||
# option compress lz4
|
||||
# LZO is compatible with most OpenVPN versions
|
||||
# (set "compress lzo" on 2.4+ clients, and "comp-lzo yes" on older clients)
|
||||
option compress lzo
|
||||
# option compress lzo
|
||||
|
||||
# The maximum number of concurrently connected
|
||||
# clients we want to allow.
|
||||
@ -371,7 +418,7 @@ config openvpn sample_client
|
||||
option key /etc/openvpn/client.key
|
||||
|
||||
# Verify server certificate by checking
|
||||
# that the certicate has the nsCertType
|
||||
# that the certicate has the key usage
|
||||
# field set to "server". This is an
|
||||
# important precaution to protect against
|
||||
# a potential attack discussed here:
|
||||
@ -381,12 +428,27 @@ config openvpn sample_client
|
||||
# your server certificates with the nsCertType
|
||||
# field set to "server". The build_key_server
|
||||
# script in the easy_rsa folder will do this.
|
||||
# option ns_cert_type server
|
||||
# option remote_cert_tls server
|
||||
|
||||
# If a tls_auth key is used on the server
|
||||
# then every client must also have the key.
|
||||
# option tls_auth "/etc/openvpn/ta.key 1"
|
||||
|
||||
# If a tls_crypt key is used on the server
|
||||
# every client must also have the key.
|
||||
# option tls_crypt "/etc/openvpn/ta.key"
|
||||
|
||||
# Set the minimum required TLS protocol version
|
||||
# for all connections.
|
||||
#
|
||||
# Require at least TLS 1.1
|
||||
# option tls_version_min "1.1"
|
||||
# Require at least TLS 1.2
|
||||
# option tls_version_min "1.2"
|
||||
# Require TLS 1.2, or the highest version supported
|
||||
# on the system
|
||||
# option tls_version_min "1.2 'or-highest'"
|
||||
|
||||
# Select a cryptographic cipher.
|
||||
# If the cipher option is used on the server
|
||||
# then you must also specify it here.
|
||||
@ -395,10 +457,15 @@ config openvpn sample_client
|
||||
# Enable compression on the VPN link.
|
||||
# Don't enable this unless it is also
|
||||
# enabled in the server config file.
|
||||
#
|
||||
# Compression is not recommended, as compression and
|
||||
# encryption in combination can weaken the security
|
||||
# of the connection.
|
||||
#
|
||||
# LZ4 requires OpenVPN 2.4+ on server and client
|
||||
# option compress lz4
|
||||
# LZO is compatible with most OpenVPN versions
|
||||
option compress lzo
|
||||
# option compress lzo
|
||||
|
||||
# Set log file verbosity.
|
||||
option verb 3
|
||||
|
||||
@ -69,6 +69,40 @@ section_enabled() {
|
||||
[ $enable -gt 0 ] || [ $enabled -gt 0 ]
|
||||
}
|
||||
|
||||
openvpn_get_dev() {
|
||||
local dev dev_type
|
||||
local name="$1"
|
||||
local conf="$2"
|
||||
|
||||
# Do override only for configurations with config_file
|
||||
config_get config_file "$name" config
|
||||
[ -n "$config_file" ] || return
|
||||
|
||||
# Check there is someething to override
|
||||
config_get dev "$name" dev
|
||||
config_get dev_type "$name" dev_type
|
||||
[ -n "$dev" ] || return
|
||||
|
||||
# If there is a no dev_type, try to guess it
|
||||
if [ -z "$dev_type" ]; then
|
||||
. /lib/functions/openvpn.sh
|
||||
|
||||
local odev odev_type
|
||||
get_openvpn_option "$conf" odev dev
|
||||
get_openvpn_option "$conf" odev_type dev-type
|
||||
[ -n "$odev_type" ] || odev_type="$odev"
|
||||
|
||||
case "$odev_type" in
|
||||
tun*) dev_type="tun" ;;
|
||||
tap*) dev_type="tap" ;;
|
||||
*) return;;
|
||||
esac
|
||||
fi
|
||||
|
||||
# Return overrides
|
||||
echo "--dev-type $dev_type --dev $dev"
|
||||
}
|
||||
|
||||
openvpn_add_instance() {
|
||||
local name="$1"
|
||||
local dir="$2"
|
||||
@ -83,7 +117,8 @@ openvpn_add_instance() {
|
||||
--config "$conf" \
|
||||
--up "/usr/libexec/openvpn-hotplug up $name" \
|
||||
--down "/usr/libexec/openvpn-hotplug down $name" \
|
||||
--script-security "${security:-2}"
|
||||
--script-security "${security:-2}" \
|
||||
$(openvpn_get_dev "$name" "$conf")
|
||||
procd_set_param file "$dir/$conf"
|
||||
procd_set_param term_timeout 15
|
||||
procd_set_param respawn
|
||||
|
||||
Loading…
Reference in New Issue
Block a user